andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,210 Commits 14 Branches 64 Tags
0233bfe543952a33194a5baf85335dc553be233e
Commit Graph
395 Commits
Author SHA1 Message Date
Paul Seidler b12ee4d23b ssh: Client HostKeyAlgorithms configuration variable (#442) 
* ssh: Client HostKeyAlgorithms configuration variable

Introduce a new variable ssh_client_host_key_algorithms to be able to configure
it for the client like for the server.
This fixes #441

Signed-off-by: Paul Seidler <[email protected]>

* sshd: Adapt the ssh_host_key_algorithms description

Linking to the latest version may lead to a broken config so be a bit more
  dynamic

Signed-off-by: Paul Seidler <[email protected]>
 2021-04-23 15:54:30 +02:00
Sina Tak Tehrani 4313d6fbfb fixed a typo in comments (#439) 
Signed-off-by: Sina Tak Tehrani <[email protected]>
 2021-04-09 08:15:11 +02:00
Sebastian Gumprich d6a99c995e use fqcn for mysql tasks 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich c6febf3249 fix linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich 7d68c6036c use single ansible fact to delete user 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich d4a4faa16d fix syntax of mysql queries 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich 5e7a0a60f1 fix linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
Sebastian Gumprich c3b954a2ab add new tasks to delete users without passwords 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 21:16:04 +02:00
schurzi add303f2be Merge pull request #437 from BenjaminBoehm/bugfix/ssh-kex-sntrup-openssh8.5 
Fix ssh kex [email protected] for openssh >= 8.5
 2021-04-01 21:13:50 +02:00
Sebastian Gumprich 2fb54bd224 remove secure-auth param if mysql => 8.0.3 
Signed-off-by: Sebastian Gumprich <[email protected]>

install collection in molecule

Signed-off-by: Sebastian Gumprich <[email protected]>

remove deprecated ubuntu 16.04 from tests

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-04-01 13:20:58 +02:00
Benjamin 29ee683069 Fix ssh kex [email protected] for openssh >= 8.5 
fix #433

Signed-off-by: Benjamin <[email protected]>
Signed-off-by: Benjamin Boehm <[email protected]>
 2021-04-01 02:08:24 +02:00
schurzi 2882a15ee1 Merge pull request #427 from dev-sec/snoopotic-fix/add_auditd_restart_handler 
add restart-auditd handler after configuration change
 2021-03-29 21:15:46 +02:00
Sebastian Gumprich 812c6c5974 skip auditd restart in molecule tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-29 10:00:15 +02:00
Sebastian Gumprich ae68f73965 skip auditd restart in molecule tests 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-29 09:29:37 +02:00
Farid Joubbi 7af432e1cf Uppercased first letter of task names. (#422) 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-25 13:52:56 +01:00
Farid Joubbi c90bbd2c23 Improved comments. (#436) 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-24 14:31:58 +01:00
Farid Joubbi d1143a06b1 Not accepting source routing for IPv6. This was already done for IPv4. (#424) 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-24 07:55:29 +01:00
Farid Joubbi 240d8acc0c Changed os_auth_pam_pwquality_options type to authtok_type. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-23 11:16:05 +01:00
Martin Schurz d693a8e200 also use requisite for pwhistory 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-23 08:53:49 +01:00
Martin Schurz 0ac56e4c00 Merge branch 'master' into pwhistory 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-23 08:53:23 +01:00
schurzi 5be13e878f Merge pull request #430 from joubbi/comment 
Remove comments from PAM config file, but keep it in the template
 2021-03-23 08:40:20 +01:00
Farid Joubbi 659e5ada6a Changed to pam_pwhistory.so instead of pam_unix.so for remembering old passwords. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-22 22:28:25 +01:00
Farid Joubbi 0010715039 Remove comment from output file, but keep it in the template. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-22 19:39:49 +01:00
rndmh3ro 369c2986c6 Prettified Code! 2021-03-22 10:23:03 +00:00
Sebastian Gumprich 02c689eaa0 fix loop for home_directories 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprichandschurzi bf82736787 Update roles/os_hardening/tasks/user_accounts.yml 
Co-authored-by: schurzi <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich c86bdcb4c7 linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich b5ca78a9cd chmod /home directories to 0700 
This is based on https://github.com/dev-sec/ansible-collection-hardening/pull/277
and updated to work with the new collection.

Thanks to @aardbol for this initial implementation!

Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-22 11:18:51 +01:00
Sebastian Gumprich 390f7ad6cc fix linting 
Signed-off-by: Sebastian Gumprich <[email protected]>
 2021-03-19 14:46:42 +01:00
Felix Herzog eca93cc80b add restart-auditd handler as after configuration change (e.g. of os_auditd_max_log_file_action) you need to restart. Sadly on rhel7 systems you cannot use systemd. And as debian derivates use service as alias and it works I kept it that simple. also adding 'auditd'-tag to make it easy only run that config change if needed. 
Signed-off-by: Felix Herzog <[email protected]>
 2021-03-19 14:42:31 +01:00
schurzi a64838272c Merge pull request #418 from joubbi/documentation2 
Improve Documentation for sysctl defaults
 2021-03-16 15:49:55 +01:00
Martin Schurz b2dd73d27e remove unneeded tasks 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:53:40 +01:00
Martin Schurz ec9d7d2cb8 cleanup and typos 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-15 23:39:12 +01:00
Farid Joubbi 97c55d6e55 Documented rationale for sysctl values set. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-15 14:01:19 +01:00
Martin Schurz 5f97dffddf Merge branch 'master' into tally 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 19:26:37 +01:00
schurzi 103135ce9a fix task naming 
Signed-off-by: Martin Schurz <[email protected]>
 2021-03-11 17:21:32 +01:00
Farid Joubbi 4158e0bfb4 Created a list of files/dirs to be looped instead of two tasks per file/dir. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-03-11 16:54:25 +01:00
Farid Joubbi 4bad4779cd Fixed copy-paste error by doing og-rwx instead of numerical. 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-22 22:13:18 +01:00
Martin Schurz 75fc31b80c remove cracklib 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-22 19:10:45 +01:00
Farid Joubbi 91a0d62305 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-19 23:19:00 +01:00
Farid Joubbi 60d24db460 Ensure permissions on /etc/crontab are configured. #375 
Signed-off-by: Farid Joubbi <[email protected]>
 2021-02-19 22:40:16 +01:00
schurzi 8e4c22d8d9 remove FQCN from roles in examples (#404) 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <[email protected]>
 2021-02-17 11:34:37 +01:00
Martin Schurz dba53718cf sssd is disabled on Amazonlinus 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 20:44:28 +01:00
Martin Schurz 4a5fa70507 default faillock to yes 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-16 19:31:51 +01:00
Martin Schurz 64713ce75d add default for new variable 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 11:17:01 +01:00
Martin Schurz ec36bf5b9c document parameter 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:22:03 +01:00
Martin Schurz 08aad6e80f add documentation 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-15 00:13:14 +01:00
Martin Schurz 28c6bf5c66 put force on the right task 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:31:24 +01:00
Martin Schurz 26c73ed1c9 fix debian faillock config 
Signed-off-by: Martin Schurz <[email protected]>
 2021-02-14 23:13:14 +01:00
Maxim Burgerhout 54c8e6aedb Split off ssh_gssapi_delegation into own variable 
Signed-off-by: Maxim Burgerhout <[email protected]>
 2021-02-14 22:07:33 +01:00